
P2P Information 
Disclosure 



or 



Identity Theft via P2P Networks is as Easy as Clubbing 

Baby Seals 



About Me 



Manager for IS Security and Disaster 
Recovery at Care New England 

Penetration Tester and Chief Research 
Officer with PaulDotCom Enterprises 

Host of PaulDotCom Security Weekly, a 
weekly computer security podcast 
discussing recent trends, news and technical 
details. 

Author with Syngress publishing, including 
Ultimate WRT54G Hacking, Using 
Wireshark and Ethereal, and How to Cheat 
at Configuring Open Source Security 




What this is all about 



Preliminary research for pen- 
testing 

• Was there anything good sti 
out there? 

• How is our education 
working? 

• How stupid/uneducated 
are people? 

Cleaner than actually clubbing 
baby seals... 




Why is this like 
clubbing baby seals? 



? 



Easy! 

Only a little patience 
needed 







Quick results 

Legal, yet morally/ 
ethically dubious 






'm not dead yet! 



gnutella is still 
around 

While usage appears 
to have declined, use 
is still high enough 
to warrant attention. 

Ratio of clueful users 
dwindling? 




Some Inspiration 



The old seewhatyoushare.com 
project 

http.7/web.archive.org/web/*/http.7/ 
seewhatyoushare.com 

Joint Strike Fighter information 
release 

• Well, at least what we hear... 

Continued stories on data 
exfiltration through P2P networks 

• 2/29/09 - Krebs, Washington 
Post, Missile silos and Michelle 
Obama's safe house 



Lockheed Martin F-35B (STOVL) 

JOINT STRIKE FIGHTER 




What we used 



Gnutella OSX clients 

Acquisition 

Poisoned 

Looking to implement 
with command line 
tools 

Mutella 




X What's New? 




Connected 
Downloads 



_ Microsoft Office 2003 Professional (Word, Excel, Powerpoinf. Acces 

[Jj 500 Templates 4 Word - Excel - Power Point (ri33tKmigell.zip 

[Jj 500 Templates for MS Word Excel PowerPoint.zip 

p| Corel Word Perfect Office XA -t Keygen [FINAI Xp and Vista|,zip 

Qj Microsoft Office 2003 - Lite [Word Excel PowerPoint Outlook. ..zip 

Qj Microsoft Office 2007 SP1 USB ThinApp - Word Excel PowerPoint.zip 

Q] Microsoft Office Word 2007 PORTABLE BLaCK EDiTiON.zip 

Jj Microsoft Office Xp Pro (Word Excel PowerPoint OutlookAcces.zip 

2j PDr to Word Converter 2 |Software][English|[www erostorrent com], zip 

[3j Portable Microsoft Word 2007.zip 

p| Solid Converter PDE 3 + Keygen (Convert PDr to WORD) (EspaAioli.r.zip 

■ Microsoft Office Word 2007. rar .torrent 
p| word + crack.zip 

[j word incl keygen by black_x (updatedhzip 

[Jj word incl keyrnaker by FIT.zip 

[p| word (cracked). zip 

tf word pre-release version. snd 

Q Will_Word.doc 

a Microsoft Office 2003 Professional (Word, Excel, PowerPoint, Acces... 

£| Wiley Microsoft Office Word 2007 for DU Mm I E5.pdf 

[[] AAA PDF to Word Converter 2.0.zip 

[Jj AdultPDr PDr to Word 2.1.zip 

Q] Core I Wo rd Pert e ct Office X4 . zip 

[[] Big Word Puzzle Book (NDS).zip 

■ Japanese words.txt 
tf ill stop word melt with you (rare track). snd 
p | SS4SSoft Convert Doc to PDF for Word v3.0.zip 



Artist 



5ize | Hitraite | 




* 
• 

• 
• 
• 
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• 

• 

• 

• 
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•kirtrkv, 28 

■k-k-k-kvi 2 5 

•••*« 2 5 

••••w 28 

****K 2 5 
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Our search methods 



Use a bunch of search terms 



a 



evil" and or common sense 
file names 

specific document extensions 

combinations of the above 



Some combinations return too 

much (with other interesting 

results), and some return too little Flm rh 

Really a great opportunity to get 
creative 



i know tint file in/uz 



i 



• Tj;"-'"ifi(flj||' 






re Somewhere 



wm 



Insert search terms 

here 

Just a few of the concepts/terms we used: 



Terms 



Filenames 



Extensions 



word 

doctor 

health 

passwd 

password 

lease 

license 

passport 

visa 



password.txt 

TaxReturn.pdf 

passport.jpg 

visa.jpg 

license.jpg 

signons2.txt 

signons3.txt 



.pst 
.cfg 
.pcf 
.doc 
.docx 
.xls 
.xlsx 
.pdf 
.tax 
.qdb 



.qmd 
.qsd 
.qtx 
.idx 
.qif 
.mny 
.ofx 
.ofc 
.txt 



ssues 



Each search is run when requested 

• Need to frequently re-request the search... 
Multiple p2p networks 

• We focused on one - Gnutella! 
Transitional nature of network 

• Users and files come in and out 




-. ■ ■_*■*'■-. 



- 



Time of day has interesting implications on 
content and volume! 



What next? 



Automated, repetitive 
searching 

Build better search criteria/ 
evilness 

Searches limited to 
appropriate IP ranges for 
client networks for use pen 
testing/targeted attacks? 

More on this in a few slides. 




P2P-NG? 



MPAA & RIAA are driving 
P2P networks 
underground 

"Next Gen" P2P *will* 
have encrypted traffic 

» but if you are a 
"member"... 

• Anti-leech features will 
exacerbate over-sharing 




P2P-TNG? 



We're not there yet.. by a 
ong shot 



DC++ and the like 

■ "Encryption" only used for 
client verification 

» anti-leech feature can 
exacerbate the over-share 
issue 







mimuw^rap 



mmes 



P2P nets will always 
have these problems 



Inference attacks 
Anomalous, heavy traffic 



Transient nature 
PEBKAC! 



Windows XP Error 




PEBKAC -Prob I em Exists Between Keyboard And Chair 



Abort 


Reliy 


Ignore 






And now... 



Some results... 
aside from music, movies, tv shows 



And now... 



Some results... 
aside from music, movies, tv shows 



...and prOn... 



And now... 



Some results... 
aside from music, movies, tv shows 



...and prOn... 



lots & lots of prOn! 



And now... 



[RMMJ 








Unexpected finding... 



Malware! 

We knew there was malware, just 
not how much 

Oh hell yeah, every thing we 
searched for we had an answer 
to... 

Expected first 8 - 12 hits to be 
malware! 

Got suspicious of all files 3.2 -3.8 
MB 

All downloaded fast, and had a 
setup.exe 




Owned! 









File unknown received on 10.23.2D0S 19:55:03 (GET) 

Current status: finished 
Result: 35/36 (97.22%) 



>Q< Comaad 
Antivirus 

Ann Lab -V3 

AntiVir 

Auchenziujii 

Avaat 

AVG 

5 i" Defender 

CAT-QuickHeal 

ClamAV 

D rWeb 

eSafe 

eTrust-Vet 

Bwidc 

F-Prct 

F-Secure 

Forti^e- 

GData 

Z 'tarus 

K 7 Antivirus 

Kaspersky 

McAfee 

Microsoft 

KCD32 

ftorman 

Panda 

FCTcols 

F r e vji * 

Hi sing 



Print results S 



Version Last Update Result 

Win32 /IRCBo. .worm. variant 
»0 cm/ Ircfiot. 2 90818 
W3 2 /Backdoor 2. UBU 

Win32 :VB-FXE 
BackDoor .VB. JX 
Backdoor . IRCBot.ABHB 

- - Backdoor . IRCBot , aro 

Trojan. IttCBot-1319 

Win32 . IRCBo- . aro 
Win32 /Reavastiboz . A 
Ba c kdoo r . Z RCflot . a r o 
W32 /Backdoor 2. L"BU 
Backdoor .Win32 . IRCBo- , aro 
W32 / IRCBot . ARO '. - r . bdr 
Backdoor . IRCBot. ABH3 
Backdoor .Win32 . IRCBo- 

- - Backdoor .Win32 . IRCBo- . aro 

Backdoor .Win32 . IRCBoz . aro 

W32/Sdbot.wnnn 

Backdoor :Win32/Rbct 

- - probably a variant of Win32/Genetik 

W32/I robot. YSH 
Bck/IRCbot.BMV 
Backdoor .IRCBot. UUX 

- - Malicious Software 

Trc- an . Win32 . VB . yzd 



►I 



VIRUS 




Virustotal is a service that analyzes suspicious 
files and facilitates the quick detection of viruses, 
worms, trojans, and all kinds of ma I ware 
detected by antivirus engines. More information. .. 



File has already been analysed: 



MDE: 

Firsc received: 

Date: 

Results : 

Pe ma link: 



58453b4elcb64c5d67ca01blGaaO96fd 

03.21.2208 24:11:59 (GET) 

10.23.2008 19:55:03 (CETS [>200D'J 

35/36 

analiai5/dbfac9161d27 07 4c3eB3507c441Bld0a 

f Show last report ") ( Reanalyse file now") 



Without further ado.. 



We'll start small and work our way up... 



FAIL 




EPIC 
FAIL 



Miscellaneous goodies 



Miscellaneous goodies 



10. After Madeline's death, why does Roderick decide to keep her body 
temporarily in one of the walls of the house? 



1 1 .What fact is revealed about the relationship between Madeline and 
Roderick, when the narrator and Roderick place Madeline in this 
temporary tomb? ., 

p eOj>t* «i/ {;«/,>,. 4*'// , 



■h*L . 



12. What behavior does Roderick exhibit in the days following this 
temporary burial? What effect does his behavior have on the 
narrator? 



13. On the stormy night about a week later, what does Roderick see out 
the window that terrifies him? How does the narrator explain this 
phenomenon rationally? 



14. Why does the narrator read a book to Roderick? What book does he 
choose and why? What kind of story does it tell? 



15. What correspondences take place between the plot of the story the 
narrator reads and'sounds in Usher's house? What are the causes 
of these sounds? 



16. If Roderick knew that his sister was alive in the tomb, why didn't he 
release her? u c 

17. In what ways does the conclusion of Poe's story relate to the title 
"The Fall of the House of Usher"? What is the light that the narrator 
sees shining though the crack in the mansion? How does this crack 
recall the description of the mansion at the beginning of the story? 






H* 









"V^ 



R 



>// 



n. 



e *f>f <, f 



Miscellaneous goodies 
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...OVtJiT* 



, j 



\t 



ftEHU. 



f;(# g g pfiH ?#**, 



«4 




OR -CRAND WEOiCAUV MECESSARY w'«aw 



4* 



Health s»i» 



Nunc: 



Employee Performance Assessment 
Revfew Period: FY 1005 

Environmental Scrv-tttl 



Depl: 
PoMttOn Title: 



< £-VU/VlS i \L CsUJ-tOU LS 



CJk 



4Lv%4- A, 



A 



teK 



WifttiH* AMUHM*. MliWHk 

fferr on "A"" ifl l4f Am i4rf tojf r^ftr A rtr rtnpfoyees ewaii peifoman^e Jar txii FetforiNaxa Gdai/Sutadard 

hittrf bajtd Oft atatiuhfJ dtpatctmt perfiHiMntt tuiidarJs 

JM.I°t^l^tfiBj 

TH1 - .Ncidi tamprrcmcil - EmpJoyw do» net dcnwnsifMt doa i:«l hrvel DfcompeiHKt and f j n h a 

dn-dopmal Li wquired w r aaplqyw is m Ed petition ud nftjwfw *41i(ifiii*| tint* wd development to be Wiy 

Acvii«ui ^ ramp*ifcnl in ihi* ml* 

GP - tJ**d Ov«iJ F Kf frFPIP ce ' tJ^byce doirorisUStiiikitriDdTcvdof EacRpctaKf io periotmini job »nd 

CMtstsEoiJly ratrti pb and ikprnount pafcrmatc fri*L wL sunfcni, 

IP" EneeptknuJ Fi |fn in | Tni|ili|iii ili iiiiiiiiiiiii ii i ■ i nil hi performing jdb and trgul ar)y exc-eexfe 

jfjb and department partormaricc gods tnc tfandarit 

Pf*« Ngt^pri>»ble - Poa not ppply. 



- *¥jTr-M ;t- * ■ V *■ r- r*f \ +? ** 



H 



Cutiogtr SitfafMtloa/mtifton; 

* ChferoJI Palicnl Salisfactioo at 
or above 95* titile raw score 

» Overall Physician Satisfaction 
at « above 95* %tile raw 



CardiovBscular case volume at 
or above 4,676 cases. 

Orthopedic case votutne at or 
above 1,656 cues. 

Surgical caw volume at or 
above 1,698 awes, 

Ca-ccr Services case volume 
at or above 494 cases. 

OB case volume at or above 

2,214 cases. 




Patient Satisfaction with 

cleanliness at or above Hie 

i!tf 'iiiLc 

Pattern Satisfaction with itatT 
courtesy at of above the 9jT 
JtrJIe 



Meets ciulomer claming 
expectation* 100% of the 
rime 

Interact* w/customers 
using acripted meaaagen 
100% of the time: 
"Welcome to Triaiiy. 

How may I belp you - I 
nave the time." 

Records doily scdriiies 
on log sheet 1 00% of the 

time 



*-"' 



kH* 



C lew/i n ess * A "3o^i 



s^A4t€ 



TftHM»fii.-H»- 



Miscellaneous goodies 



Friday\ April 25 

S:00am- 12:00am 
5:30pm -6:00pm 
6:00pm - 9:30pm 

Saturday, April 26 

9:00am- 12:05pm 
9:04am- 11:30am 
1 1:45am- 12:00pm 



155 Candi 
i Tony 
Sand) 



THE 2008 CHEERLEADING WORLDS 
EVENT SCHED ULE 



Airport Arrivals 

Buses depart from hotel for VIP Reception 

VIP Reception 



Disney V Hollywood Studios ™ (Indiana Jones Theater) 

International Junior All Girl Preliminary Competition 

International Junior Coed Preliminary' Competition 

International Junior Coed Finalist Announcements 



[157 
158 

1 159 
160 



Bambi 
Daniele 

Raymond 



29-Apr 


Southwest 


3221 


5:10 PM 


Shuttle 


25ft 


29- Apr 


Delta 


1790 


6:05 PM 


Shuttle 


32;i 


29- Apr 


Delta 


1790 


6:05 PM 


Has Tranpsortation 


3ih 


29- Apr 


Atriran 


460 


6:05 PM 


Has Tranpsortation 


44'4 


29- Apr 


Delta 


i&74 


6:25 PM 


Shuttle 


413 


29- Apr 


Southwest 


asi 


7:55 PM 


Shuttle 


504 



2008 Worlds Judges Rooming List 



i Denise 
Jennifer 

2 Brian | 

3 Daniele 

Sa 





24-Apr 


2fi-Apr 


Cheer 




24-Apr 


2fi-Apr 


Cheer 






1 25-Apr 


29-Apr 


Cheer 



25-Apr 
25-Apr 



29-Apr 

29-Apr 



Cheer 
Cheer 



Miscellaneous goodies 




THE 2008 CHEERLEADING WORLDS 
EVENT SCHED ULE 



D 



E F 

Arriving Avis Confirm # and 

Flight # Arrival Time Transportation 



24-Apr 
24-Apr 
24-Apr 
24-Apr 
24-Apr 
24-Apr 
24-Apr 



Delta 


6145 




Delta 


6069 


Airtran 


409 n 


Southwest 


3251 


Northwest 


956 


American 


1464 


American 


1464 


Delta 


1667 



11:55 AM 



3:45 AM 
1:44 PM 

2:15 PM 
4:2&PM 
6:25 PM 
6:25 PM 
10:29 PM 



Has Ride 

(USl 
Has Ride 

Denise Baker 
Shuttle 

1&US4 
Larma 
Shuttle 



Denise 


24-Apr 


2fi-Apr 


Cheer 


Jennifer 


24-Apr 


2fi-Apr 


Cheer 




Brian 1 


25-Apr 


29-Apr 


Cheer 










Daniele 


25-Apr 


£9-Apr 


Cheer 


SarsL 


25-Apr 


29-Apr 


Cheer 



Emergency Cell 
Number 



256 
317 

2£; 

713 



5li^ 



Miscellaneous goodies 




RENTAL APPLICATION (Conventional Portfolio) 

{Fact* person over IS jimI nol a dtptmltm ntuil urbmit s* scpnralr application) 
(Spollits may complete ■ joint a pp Fixation} 



Tq be campletrtf £/ Qwnfr flf Owflff'l ReprtStnfatire 
COMMLTflTY NAME: It* Preserve al 1 lid Jen Creek 




APT, NO. ASSIGNED: M*EN DATE; 


LEASE TERM: 


STREET ADDRESS t>F APT- NO. 




RENTAL RATE OFFERED: 




CONCESSION OFFERED: 


Ctfapptkitbk} 

DATE COMPLETED APPLICATION RECElVEDr 




DAI? A1T1 K \NI MOI1FIT- D OF APPRO ViM 111 MAI 


PROPERTY REP,: 





CENERALt 




Nome; 



Social Sccuritv Number 




Have you ever 
Ye* please list 



■» K-ro toraM" -^gar^ ^id?5..jPf- 

Drivers license No, and Slate ' OR A\v\\. fssucd Pfcnio ID Nsi, 

jn> crthrr name^or aliases? Vet No ^,1 



^T K M1 



Employer 'a Slrtiet 



■n.irvs r 




P. $& U$ 7<? 



^iij 



Slate 



Position Held wilh Present Employer 



Supcrv umjc's Nimc fTj 




1 



Telephone ^°- _ - 



!L>L 



Gross Monthly Income 



Lenfth dT £mplo}mcnt 



Telephone Number 



Miscellaneous goodies 




RENTAL APPLICATION (Conventional Portfolio} 

{Fact* person over IS and nol a dtptmltm ntuil whmit s* scpnralr application) 
(SpoUirs may complete ■ joint appFiearion} 



Ti* br i-umpfrtrti Aj- Ovner nr Qwntr'f Representative: 

COMM L TM I T Y NAM I ■ 1 nc Preserve * I lid Jen Creek 



APT. NO. ASSIGNED: 

STREET ADDRESS OF APT, NO, 

RENTAL RATE OFFERED: 

CONCESSION OFFERED: 

fifapfAktibk) 

DATE COMPLETED APPUCATK 

OATli APPLICANT NOI TF [f I) Of 



APPLICATION DEPOSIT AND NON-REFUNDABLE FEES: 
Simultaneously wilh the necirtitm ©f ittw Application,. Applies*' hj,,< p™ 1 ' 1 

Application Deposit (Hie "Application Deposit*) S 200 JO 

Nun-Refundable Application Fee S40.00cach 

Non-Refund uMe Adminislral kc Fee S I5U.O0 

i i-'.il % 



Cheek Number 


00 


Check Number 


fll 


Check Number 


— * 00 




Name i 



OWNER: 




Have you ever 
Ye*, Please list 



Employer 's Street 



THXFRESBt 

«-3 a 



ignaiurc' 



J 



IN CREEK APARTMENTS 



i iwers Lken 
j;t> other name* or alijm Name Primed: Ml 






IfcUe: 



m^s/o^ 



^T K M1 



■n.irvs r 




^ity 



State 



Position Held with Present Employer 



Supcrv umjc's Name fTj 



tS 



»^y? 



_J*. 



*4 Monthly Income 



i J( Eim 



Z^ 



Lenfth df Employment 



Telephone Number 



APPLICANT: 



,:ure:/^f 
Name I [ftl j£€/ 
PMC 



/ 



: I'rinieJw^i^j 



S S i;.-r:.iL urt: 
Same Printed: 
Date: 



Miscellaneous goodies 



LAST WILL A\D TESTAMENT 
OF 



1.1: 



_ residing in C ran ite City, Madison County, Illinois, 



being of so una mina ana disposing memory, do hereby make, publish and declare iritis to be 

my Last Will and Testament, hereby revoking all Wills and other testamentary dispositions 
made by me heretofore, 



ARTICLE ONE 

[ do hereby direct thai my Executors, herein a Iter named, pay all my Just debts and 
funeral expenses as soon after my death as may be convenient. My body shall be taken to 
the Irwin-Scott Chapel on Maryville Road. I want no one. other than my two children to 
view my remains, there will be no wake or funeral. Burial v, ill be at Valhalla Cemetery in 
Belleville, IL. 



ARTICLE TWO 



I do hereby give and bequeath to my beloved daughter. R < 

my clothing, jewelry, sewing machine, Becker clock, the painting oy Carcia, 
and all personal papers owned by me at the date of my death to do with what she will 



[ do hereby give and bequeath to my son, 



the video of 



Home Movies, because Rebecca already has a copy, an grave lot in Valhalla Cemetery, 

Belleville, IL has already been deeded to him. taking effect at the time of my death, 

The family pictures ean be looked at and *ach of mv children *hall keep any he or 
she wants. All the rest shall be retained by R _ to insure they are 

not lost to future generations of our family. 






ARTICLE THREE 

[ do hereby give and bequeath to my beloved son, h ^H^E. all my 

tools, my computer equipment and all Thomas ville furniture totaling 7 pes. from the 

bedroom and 5 pes. from the dining room. Any CD's floppy disks, books, files, papers 

oertalning to my genealogy researeh will be given to my daughter, HL^Mtf^^H 

^K. to be kept safe until someone down the line, in our family, would want tnem. to 

continue the genealogy researeh, then at her discretion, she may give then to that person. 



Miscellaneous goodies 



Retirement Needs 

H H and A S 



Objective 



Save enough for a secure and comfortable retirement. 

Needs Analysis 



Monthlv Income Goal & Benefits 




Assumptions 


Current employment income 

Income goal % 

Income goal in today'* S 

Income goal in future S 

Social Security benefits 
Monthly pension benefits 


$17,500 

20% 
$3,500 
55,453 

Exclude 
Exclude 


Retirement Age 
Life Expectancy 

Current retirement savings 
Current monthly savings 

Inflation rate 

ROR before/during retirement 


66 (15 yrs) 

95 (29 yrs) 

$34,000 
SO 

3% 

12%/6% 



* Due to inflation, your projected income need will be $5,453 per month the first year of your retirement. 
To provide your retirement income goal for 29 years (to age 95), you need to accumulate $1,247,000 by retirement 
age 66, This is your Kinancial Independence Number.** 

One way to do this is to save SI, 778 each month and increase this amount 3% each year. This is $1,778 more than 
you arc now saving. This would increase your retirement savings to 10% of your current employment income. 



The Rule of 72 


72 + 3%= 72-6%* 
24 years 12 years 


72+ 12% = 
6 years 


The Rule of 72 approximates the number of years it 


Beginning S34,000 534,000 


534,000 


takes to double your money, ff you earn a 12% rate 


Year 6 


$69,600 


of return your money would double every 6 years. 


Year 12 $69,700 
Year 1 8 


$142,500 
$291,700 


(72- 12% = 6 years) 


Year 24 $69,800 $143,000 


$597,100 


You have 2.5 doubling periods uitiit your retirement, assuming 


12% ROR. 




Retire at 


Retire at 


Retire at 




Age 61 


SS Age (66) 


Age 71 


Retirement fund required * 


51,163,000 


SI, 247,000 


$1,278,000 


Monthly savings needed 








at 5% before retirement, 4% during 


$8,499 


$4,773 


$2,837 


at 8% before retirement, 5% during 


$6,105 


$3,151 


$1,701 


at 12% before retirement, 6% during 


$4,061 


51,778 


$755 



Miscellaneous goodies 



% 



v 





Taxpayer Identification * 

Numbers (TIN) 



Taxpayer Identification ""• 






Numbers (TIN) 




Department of the Treasury 
Internal Revenue Service 
AUSTIN, TX 78714-9342 



Date of this notice: 08/14/2007 

Number of this notice: CP565 

Form: W-7 

Case Reference Number: 

20294 

DOB 




JEFFERSON CITY, MO 65101 



For assistance call us at: 

(215)516-4846 

For international callers 

(215)516-4846 

This is not a toll-free number 

Or you may write to us at: 
Internal Revenue Service 
POBOX 149342 
AUSTIN, TX 78714-9342 



WE ASSIGNED YOU AN IRS INDIVIDUALTAXPAYERIDENTIFICATION NUMBER (ITIN) 



Taxpayer Identification ""• 









Numbers (TIN) 




Department of the Treasury 
Internal Revenue Service 
AUSTIN, TX7S71 4-9342 



Date of this notice: 08/14/2007 

Number of this notice: CP565 

Form: W-7 

Case Reference Number: 

202fti^ BL ^ 

DOB 



M 



JEFFERSON CITY, MO 65101 




For assistance call us at: 

(215)516-4846 

For international callers: 

{215)516-4846 

This is not a toll-free number 

Or you may write to us at; 
Internal Revenue Service 
POBox 149342 
AUSTIN, TX 78714-9342 



Taxpayer Identification ""• 



Numbers (TIN) 





Department of the Treasury 
Internal Revenue Service 
AUSTIN, TX 78714-9342 



Date of this notice; 08/14/2007 

Number of this notice; CP565 

Form; W-7 

Case Reference Number: 

20294HBfl^ 

DOB 



JEFFERSON CITY, MO 65101 



For assistance call us at: 

(215)516-4846 

For international callers: 

(215)516-4846 

This is not a toll-free number 

Or you may write to us at; 
Internal Revenue Service 
POBox 149342 
AUSTIN, TX 78714-9342 



WE ASSIGNED YOU AN IRS INDIVIDUAL TAXPAYER IDENTIFICATION NUMBER (ITIN) 



916- 




Taxpayer Identification ""• 



Numbers (TIN) 




Department of the Treasury 
Interna! Revenue Service 
AUSTIN, TX 78714-9342 



Date of this notice: 08/14/2007 

Number of this notice: CP565 

Form: W-7 

Case Reference Number: 

2029- 

DOB 



JEFFERSON CITY, MO 65101 



70 



For assistance call us at: 

(215)516-4846 

For international caflers: 

(215)516-4846 

This is not a toil-free number 

Or you may write to us at: 
Interna! Revenue Service 
POBox 149342 
AUSTIN, TX 78714-9342 



Taxpayer Identification ""• 



Numbers (TIN) 




Department of the Treasury 
Internal Revenue Service 
AUSTIN, TX 78714-9342 



Date of this notice; 08/14/2007 
Number of this notice: CP565 
Form: W-7 
Case Reference Number: 

20294a^VHV 
DOB 



JEFFERSON CITY, MO 65101 



For assistance call us at: 

(215)516-4846 

For international callers; 

(215)516-4846 

This is not a toll-free number 

Or you may write to us at: 
Internal Revenue Service 
POBox 149342 
AUSTIN, TX 78714-9342 



Taxpayer Identification ""• 



Numbers (TIN) 



fi 




Department of the Treasury 
Internal Revenue Service 
AUSTIN, TX 78714-9342 




JEFFERSON CITY, MO 65101 



WE ASSIGNED YOU AN IRS INDIVIDUALTAXPAYER IDENTIFICATION NUMBER (ITfN) 







Date of this notice: 08/14/2007 




Number of this notice: CP565 




Form: W-7 




Case Reference Number 




2029^ ^ZT 




DOB 








For assistance call us at: 




(215)516-4846 


For international callers 


(215) 516-4846 




This is not a toil-free number 




Or you may write to us at: 




Interna! Revenue Service 


POBox 149342 




AUSTIN, TX 78714-9343 





Taxpayer Identification ""• 



Numbers (TIN) 




his notice: 08/14/2007 

of this notice: CP565 

-7 

ference Number 



tance call us at: 
6-4846 

(national callers 
6-4646 

t a toll-free number 

ay write to us at: 

evenue Service 

149342 

TX 78714-9343 










Turbo Tax Returns 



Turbo Tax Returns 






Form 



Departmenl of Ihe Treasury — Internal Revenue Service 

1 040 U.S. Individual Income Tax Return 2008 



Label 

;5b8 iiTslrudions.] 

Use the 
IRS label. 

Otherwise, 
please print 
or type. 

Presidential 

Election 

Campaign 



(99) 



IRS Use Oily — Dp not wrle o~ stape in his space. 



For Ihe year Jan 1 - Dec 31, 200B, or other tax yeap beginning 



2.D0S. ending 



_i 



20 



Your firs* nane 



M Last name 



IF a joint return, spouse's First name 



Ml Last name 




Home acdresa fnun-De- a-<d sreet!'. If yc j have a P.O. box, sea inEtrucnc-TS. 



Apartment no. 



C 1y. :cw- or post oHice. i" you 

TROY 



c'-aigi adc-est, see iTslruc-lic-ns. 



State ZIPccce 

MI 48084 



QMB No. 1545-0074 



Your social security number 

368- *^m 



Spouse's social security number 

382- 



You musi enter your 

. social security . 

A numbers) above, A 



^ Check hep e If you, cf your spouse il liliig jointly, want S 3 lo go to this lund? (see instfucilons} . 



C'iec<iriga box below will noi 
change your tax. or re fund. 

*■ \ J You JSpojse 






Filing Status 



Check only 
one box. 



1 
2 
3 



Single 

Married tiling jointly (even il only one had income) 
Married tiling separately. Enter- spouse's SSN above 
name here. * 



Head of household (with qualifying person). (See 
instructions.) If the qualifying person is a child 
but not your dependent, enter this child's 
name here * 



Qu-alilyhy widower) yyjh tie pis idem chile (see instruction: 






Exemptions 



6a 

b 



Yourself, ft someone can claim you as a dependent, do not check box 5a. 
Spouse ■ . - . . 



c Dependents: 



(1} First name 



Last name 



L^ 



If more than 
four dependents, 
see instructions. 



(2) Dependent's 

social security 

number 



(3) Dependent's 

relationship 

to you 



379-_ _^ 



Son 



379- 



Daughter 



(4>t^if 

qualiryHg. 

child For child 

tax c _ ec l 

{see instrsy 



d Total nunber of exemptions claimed - 



Boxes checked 
an 6a and Go - 

No, of children 
on So who: 

* rived 

with you ■ - - 

• did not 
live wrth you 
due to divorce 
or separation 
(see instrs) ■ - 

Dependents 
on Sc not 
entered above - 

Add numbers 
on Tines 
above • - • ** 



inrnmc 



7 Wages, salaries, tips, etc. Attach Form(s) W-2 ■ 



392,323 



Turbo Tax Returns 






Form 



Departmenl of Ihe Treasury — Internal Revenue Service 

1 040 U.S. Individual Income Tax Return 2008 



Label 

;5b8 iiTslrudions.] 

Use the 
IRS label. 

Otherwise, 
please print 
or type. 

Presidential 

Election 

Campaign 



(99) 



IRS Usb Oily — Dp not wrle cr stape in his sp-sce. 



For Iheyear Jan 1 - Dec 31, 200B, or other tax yeap beginning 



2.D0S. ending 



_i 



20 



Your firs* nane 



M Last name 



IF a joint return, spousal First name 



Ml Last name 




Home acdress. fnun-De- a-<d sreetj. If yc j have a P.O. box, sea inEtrucnoTS. 



Apartment no. 



C 1y. :cw- or post oHice. i" you 

TROY 



c--3igi adc-ess, see iTslruclio-ns. 



State ZIPccce 

MI 48084 



QMB No. 1545-0074 



Your social security number 

368- *^m 



Spouse's social security number 

382- 



You musi enter your 

. social security . 

A number(s) above, A 



^ Check hep e If you, cf your spouse il liliig jointly, want S 3 lo go to this lund? (see instfucilons} . 



electing a box below will noi 
eh an ye your tax. or re fund. 

*■ \ J You JSpojse 






Filing Status 



Check only 
one box. 



1 
2 
3 



Single 

Married tiling jointly (even il only one had income) 
Married tiling separately. Enter- spouse's SSN above 
name here. + 



Head of household (with qualifying person). (See 
instructions.) If the qualifying person is a child 
but not your dependent, enter this child's 
name here * 



Qu-alilyi'iy widower) yyjh tie pis idem chile (see instruction: 



Exemptions 



6a 







Yourself, ft someone can claim you as a dependent, do not check box 6a. 



Boxes cheeked" 
on Gaand 6b - 



File by Mail Instructions for your 2008 Federal Tax Return 

Important: Your taxes are not finished until all required steps are completed. 

(If you prefer, you can still e-file. Go to the end of these instructions for 
more informatics ' 

DR 
TROY, MI 48084 






Balance 

Due/ 

Refund 



Your federal tax return (Form 104 0) shows you arc due a refund of 
$3,264.00. Your refund will be direct deposited into the following 
account: Account Number; 1795, Routing Transit Number: =r"791 



Turbo Tax Returns 



Form 



Department oF Ihe Treasury — Internal Revenue Service 

1 040 U.S. Individual Income Tax Return 2008 



(99) 



IRS Use Q-ily — Dc not wr 1b c-r staple in this space. 



Label 

(Sea i-tBlruclicns.) 



Fot ih& y&af Jan 1 - Dec 31 , 200B, op oihepiaxyeap beginning 



, 200 B, ending 



,20 



Ynurlirsl name 



Ml Last nnf 



Use the 
IRS label. 

Otherwise, 
please print 
or type. 

Presidential 

Election 

Campaign 



IF a jdinl relurn, spouse's First name 



" 



Last nane 



Homo address (number end street). IF you heve e P.O. boot, see instructions. 



Aca^me-t no. 



■w ly. lawn or past office. II you have a loreign adCest, see iiilrud-'icis. 

Clovis 



SLl.Il- ZPccde 

CA 93611-0000 



OMB^Jc. 1G4D-O07-1 



Your social security number 

367- 



Spouse's social security number 



You must enter your 

. social security . 

A. number(s) above. A 



^ Check here if you. cp your spouse il Wing jointly, want % 3 lo go to Uiis 1und? (see insertions) . 



Ciec<irrQ a box below will not 
change yo up lax oppefurrd. 

] You ] Spouse 



Eilin/i Qtatiie 



Single 



4 |X | Head ot household (with qualifying person), (See 



Electronic Filing instructions for your 2008 Federal Tax Return 

Important: Your taxes are not finished until all required steps are completed. 





Clovis, CA 93611-0000 



Balance 

Due/ 

Refund 



Your federal tax return (Form 104 0) shows a refund due to you in the 
amount of S4 66.00. Your tax refund should be direct deposited into 
your account within 8 to 14 days after your return is accepted: 
Account Number: 541270 Routing Transit Number: 72594. 



Turbo Tax Returns 



Form 



Department oF Ihe Treasury — Internal Revenue Service 

1 040 U.S. Individual Income Tax Return 2008 



(99) 



IRS Use Only — Do not write or staple in this space. 









Label 

;See ins1ruc-1ions.) 

Use the 
IRS label. 

Otherwise, 
please print 
or type. 

Presidential 

Election 

Campaign 



For Iheyear Jan 1 - Dec 31, £009, of other ton year beginning 



. £00 6, Ending 



20 



Yaur first name 



Ml Last name 



IF a joint relum, spouse's First name 

Horns andrass (numba - a-d slneat). IF you have a P.O. boa, sea instructions. 




Apartment no. 



Grty, luwn u, pilbi ui. 

modesto 



j ju nave a loreign ade-ess, tee inatmctiona 



State Zl P c;oc"e 

CA 95355 



OMBNo. 1S45-0074 



Your social security number 

545 = " 



Spouse's social security number 

557- 



You must enter your 

. social security . 

A number(s) above. A 



Checking a box below will rtol 
change your to or re fund. 



^ Check here if you, or your spouse il lilhg joinciy. want S 3 10 go to tills turd? (see instructions 



+ ]you ]Spo 



use 






Filing Status 



Check only 
one box. 



1 
2 
3 



Single 

Varied liling jointly (even il oily one had income) 
Mailed liling separately. Enter spouse's SSN above & 
name here, * 



Head ot household (with qualifying person). (See 
instructions.) If the qualifying person is a child 
but not your dependent, enter this child's 
name here * 



Qualifying wiJuw- ur) wih dcpndenl chile (sec iristf 1 jctiuna: 






Exemptions 



6a 

b 



Yourself. V someone can claim you as a dependent do not check box 5a, 
Spouse 



c Dependents: 



{1} First name 



Last name 



If more than 
four dependents, 
see instructions. 



(2) Dependent's 

social security 

number 



61B-, 



604' 



(3) Dependent's 

relationship 

to you 



Daughter 



Son 



(4} /if 

qualifying 

child For child 

tax credil 

(see instrs) 



d Total number of exemptions claimed 



Boxes checked 
on 6a and 6b ■ 

Mo. of children 
on Sc who: 

* Fived 

with you ■ - . 

• did not 
live wrth you 
due to divorce 
or separation 
[see instrs) - - 

Dependents 
on Sc not 
entered above - 

Add numbers 

on lines 

above - - - ^ 



4 



7 Wages, salaries, tips, etc. Attach Form(s) W-2 - 




109,589, 



Turbo Tax Returns 



Form 



Departnnenl of Jhe T-easu-y — Internal Revenue Service 

1 040A U.S. Individual Income Tax Return (99} 2008 



IRS Use- Only — Do not write or slaple in this space . 



Label 

(See instructions.) 



Use the 
IRS label. 

Otherwise:, 
please- print 
or lypo. 



You" J irsjt "ame a~d in "iai 



Last na"ne 



Presidential 



, Mr 



If a join! return, spouse's first name and initial 



Last name 



Home address (number and street). IF you have a P.O. box, see instructions. 

Drive 



Apalme-tt no. 



Cray, nwrr or post office. It you have a foreign address-, sea instructions. 

Ludington 



State ZIP coda 

Mr 49431-0000 



OH/BNo. 1D15-CC71 



Your social security number 

370- 



Spouse's social security number 



j^ You must enter ^ 
your SSM(s) above 



Checking a box below will 

not change your 

tax or refund 



Turbo Tax Returns 



Form 



Dapartmenl of Jhe T-easu-y — Internal Revenue Service 

1 040A U.S. Individual Income Tax Return (99} 2008 



IRS Use- Only — Do not write or staple in this space . 



Label 


Vou 1 : ' - i' "UTic d ,,- J! inlia Last na-ne 

^^v Tooman, Mr. 


OMB No. 1 545-0074 


(See instructions.) 


Your social security number 

370- | 


Use the 
IRS label. 

Otherwise-, 


II a ,oin" 'Bturi, spouse's first name and initial Last name 


Spouse's social security number 


please- print 
or type. 


Home address (number and street). IF you have a P.O. box, see instructions. Apa~1me~t no. 

2 603 N. -«^tae^ Drive 


J^ You must enter ^ 
your SSM(s) above 




Cily, town or post office. It you have a foreign addness, sea instructions. 5t=Ue ZP cede 


Checking a box below will 



Electronic Filing instructions for your 2008 Federal Tax Return 

Important: Your taxes are not finished until all required steps are completed. 








Ludington, Ml 49431-0000 



I 



Balance 

Due/ 

Refund 



Your federal tax return (Form 104 OA) shows a refund due to you in the 

amount of $741.00. Applicable fees were deducted from your original 
refund amount of $741.00, Your refund is now $6 61,15. Your tax refund 
should be direct deposited into your account within 3 to 14 days 
after your return is accepted: Account Number: j 42 12 Routing 
Transit Number: 52511 



Turbo Tax Returns 



I 



Department at the Treasury — ■ Internal Re ramus Service 

Form 1 040 U.S. Individual Income Tax Return 2006 



l,99) IRS Use Only — Co tj: -•-■\te or slaule h m .h a soace. 



Label 

(See instructions.) 



Fonhe ys-ar Jan 1 - Dec 31, 2006, or other ta* year beanrms 



2006, entfing 



,20 



Your First name 



Ml Last name 

w. 



Use the 
IRS label. 

Otherwise, 
please print 
or type. 



Presidential 
Election 



tf a joint return. spouse's 'irst name 



Ml Last name 



Hr-no add'sss dumber and street). 11 you have ± P.O. box, see nsructons. 



Apartment no. 



City, town or post office. If you tiara a tore gn address, see instruction: 

East Stroudsburg 



Stale ZIP code 
PA 18301 



cvbno. 1 d ■'■; :c-^ 



Your social security number 

149-^.- 



Spouse's social security number 



You must enter your 

social security 

A number(s) above. A 



Checking a box below will nol 
change yooMaxci pel one. 



in i i Al uA.nl AAA.11AA \t lilIriiH ir'Liri-H A rh4 



in i-iha ■■--■•.--■■■ 



File by Mail Instructions for your 2006 Federal Tax Return 

Important: Your taxes are not finished until all required steps are completed. 

(If you prefer, you can still e-file. Go to the end of these instructions for 
more infnmatir"" 1 ^ 



v 





£,55"c aurouQBDurg, PA 18301 



Balance 

Due/ 

Refund 



Your federal tax return (Form 1040) shows you are due a refund of 
$10,073.00 



Turbo Tax Returns 




ELECTRONIC POSTMARK - CERTIF 
TAXPAYER: 3^^^~ —-^* T A^^fi. 

PRIMARY SSN: :>4b- 



i 



r 



Electronic Filing Instructions for your 2007 Federal Tax Return 

Important: Your taxes are not finished until all required steps are completed. 







Declaration Control Numbe 





pted: 02/03/2008 



Street 

L'Anse, MI 49946-0000 



Balance 

Due/ 

Refund 




Your federal tax return (Form 1040) shows a refund due to you in the 
amount of $2,571.00. The IRS estimates that you can expect your tax 
refund to be direct deposited into your account between 02/15/200 8 
and 02/19/200S. This is only an estimate. Account Number: 67 975 
Routing Transit Number: 123 < 



I 



2007 


Adjusted Gross Income 


Federal 


Taxable Income 


Tax 


Total Tax 


Return 


Total Payments /Credits 


Summary 


Amount to be Refunded 




Effective Tax Rate 






103,039 

B0, 080 

12,B6G 

15,437 

2,571 



00 
00 
00 
00 
00 



12.49% 



Turbo Tax Returns 



r 




Electronic Filing Instructic 

Important: Your taxes are not fin 






Declaration Control Numbe 

^■r Street 

L'Anse, MI 49946-0000 



Balance 

Due/ 

Refund 




Your fede 
amount of 
refund to 
and 02/19 

Routing T 



2007 

Federal 

Tax 

Return 

Summary 



i 




due to you in the 
n expect your tax 
tween 02/15/2008 
Numben 67 975 



103,039 

B0, 080 

12,B6G 

15,437 

2,571 



00 
00 
00 
00 
00 



12.49% 



Social Security Cards 



Social Security Cards 




ip lh.» «iib with >™r penunal cwnrts. Tte olher «fe rtwrkl import™. 



urniiiiior. 




LANE 



YOUR SOCIAL SECLRH Y LAb 



Detach dw curt bdttV and sign ii in in* mimcotaly 
keep vour card in a saw ylnce tc preverv. «w rr u- 



Keep 
DOMriC^RVlTWHUVOl 

no vt&L Laminate vour card. 




Social Security Cards 



;rity uvu 

it in. in k: mimcO'i^Lt'lY 
proven'. 'iois> cf J .-Y^' : 




Visitation Visas 



Visitation Visas 



I I I I 



apis -J.ittio-ws 



WES 

H 




I f I I I I f J I I t I ' 



* % a 



%&t'Ql }>Q^ & 



Tt 5 






*\ 



E|s[ A|iiuff-| .. I * 5 7T j-j ■ ■, 
-1!— - — I hi305 | 






1 1 ki.i.iji .ijiu.riMJ.ui 
Ml 



. .f I 






.«5£ ■■" 



T 



I t I 



" r "TT 



T1 



2T 



Il0-|«l OKflWO 



Jjq-.uii^ 3jniiLtlJi(J 




M 
H 29tWV2QQ5 

ArinDta!ior> 

PA; --< 

PET NAHE: T SYSTEMS INC 

PET #; SRC-0S-1&5-51OSQ 

PET EXP DATE: 3D SEP 2008 



^SE0FFREY< 



^^^» " ri»jiL 

£»pir»LW Data 









aaaH d id i vis 



3pi^_£3tfl£J J3$ 



1 ' l 7i> / .i//,'H/Wi/i I if r~x^ 

*• lllL|iUMlU-) |LI MUM nil I e_ C 

j — - u i . ' j — *w g 5 — 



n~ t 









I - 



T 



1 . I I 

- _ -- 

n — r -1 — ■"■ _, — 



1 



r- 



v ^5- "'.;: ■ V." '7 ■-■.--■ 



■ i.:r',. -. I ... il .- 



3 



|J.HIJ,1}[ J.IIHJI!(ij(| 

HI 



TT 



"T^T 



2T 



*¥' 




" I - 



5 3 






I I IG- 1 J9 1 Cl -N EJtNl > 



J3quih|s[ sinufidi{| 




Entrtax 

H 

AnnDlnlifr* 

PET NAHE: T SYSTEMS INC 
PET #: SRC-0&-18S-S1050 
PET EXP DATE: M SEP 2008 



««<<<<<«« 




w 



Visitation Visas 



(HnOt) t61 bug j(JB3 

I' I I I I I 



J P!S J ^JIO M S 



i r i 



rrr 






1 '/'cvVJ'^ii^'/yW^ 



o 



quia ' 

I I I 1 I I I I 






I J ' - — z 



ArtKjJ 4|1Uiej 




tUQ-|S9I «NHNO 



is^um^ jjnutdSfj 



#51 



^ .^feifr: 



•<J,- 



^MSiWSB&Sffl^^^^ 



isM.iii'ii Pest Name 

warn a 





Sam 

N 

M 29NOV2005 

PET HAHe7*T SySTEHSIMC 

PET #j SfiC- 05- 165 51050 
PET EXP DATE: 30 SEP 2008 



Comr^ Wuufcw 



• --— — ji^ji uniir 

T ~pPRIL 

Eadif»L*&-i Daw 

30SEP20W — *- 100] 




» . 




«<<<<< 






WW auvxs 

£fO«IJlnS,-tli4jLy i |!gj" 



fP!S.nv)0»s 




pJth3J W Jj n)j | S[ l J(| 




M 

PET HWE: T SYSTEMS IMC 
PET #: SRC -05 -185-51050 
PET EXP DATE: 30 SEP 2006 



<<<<<<< 




Visitation Visas 



UI1H JI IclVlS. 

1 1 ii ■ | ,n /- ll,: MI: ' 



^I'l^ - i, "L'^.» 



"I I I 



\~ r' 



71 



.1 .!■-■■.■-"- -■ 1 1" .) •■■■'■ ■'■'■' 




3i ei 



1 1 SD02 9 AON H 



1: 



10 1 



\.. ^..VWC ^ „^f 



^Sllw**^-r^-- ~^ l_r T 




li.ir.-.i'- ■'sS^O 




'5 PN-T SYSTTEM iHC 
' ; p#.SRC 05-160-50597 




««<<«■«« 



aaaHXMLY*? 




T a 



£ 



i - - ■■ 

■ V 



£ yi;^. 









2T 



IH0-1S5I 'JHUW.J 



VISA 






^HXsfv^^A^jjiy 




■'JS* 



1 



***-. 



tabuing Ponr Nn*nr 

MANILA 

Summe 



(Vvao Nam* 
ntttanr Numt* 



Cowo' Ht* 



5fcK 

H 

ISiu» OACfl 

29NQV2005 




M 

Alil'CI I"'" - 

PA: _- ^ T GL. 
PET NAME; T SYSTEHS INC 
PET #; SRC -05 185-51050 
PET EXP DATE: 30 SEP 2006 



sosEranra^"*** om 





<««« 




T'T i 'iiJlTIi 



^^^l^fflt^t*™-" = * i-, ~ 



1 1 ii " | . i-. . "-- 1 ■■ : I -.1 1 : ^ 



Visitation Visas 




IDs/Licenses 



IDs/Licenses 







y% 



NUMBER 



DRIVER'S LICENSE 
~Jfc expires 11 -28-2010 



CUMMING GA 30040-7376 

R10THDATE EXAM DATE COUNTY 

j» 06-02-2006 058 
C S FEE RESTRICTIONS 

020 00 



SEX 

HEIGHT WEIGHT 
5-01 105 



CLASS 

c 



064 

ENDORSEMENTS 



TYPE 
REG 



r* 



COMMISSIONER 



^* DRIVERS LICENSE 




expires 03-19-201 1 



CUMMING. GA 30040-7376 
MSTHDATI 



SEX 
M 

HEIGHT 
5 04 

CLASS 



135 



etc 

1 64 

NTS 



' 



EXAM DATE COUNTY 
I 2 0<S 2005 058 
F I E RESTRICTIONS 
020 00 

■G 







State of North Carolina Htm 



0nnnMs«on*t of 



Moiof Meat 



DRIVER LICENSE 



I- 



k 
"% 





RD 

Colfax, nc 27235-9726 

cfass C endors M restr None 

issued 06 22 2000 expires 06 30-2005 
W rH 6-02 BLU hair BLO race 






PHILIPPINES 

REPUBLIC OF THE PHILIPPINES 

DEPARTMENT OF TRANSPORTATION A COMMUNICATIONS 

LAND TRANSPORTATION OFFICE 

EAST AVE QUEZON CRY 

MILLENNIUM PROFESSIONAL 

«ST NAME, MI0DLE NAME 

| RONCHIE 

ADDRESS ML - mi. ZTTr , MON,, PROVINCE) A^S 

TAGLESVILLE CAP1T ANGAN ABUCAV BATAAN 

BIRTH DATE SEX HfMcm] WT.Jkg) NATIONALITY 

^MV M 170 55 FIL 

RESTRICTIONS CONDITIONS AGY EXPIRES 

123 C02 2011 

u emm um 

U^OANSNB 
flfTARY 






SIGNATURE OF LICENSEE 






«^ ,*Ts 




I 



IDs/Licenses 








•v% 



NUMBER 



,.M* 
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...and the coup de grace 




The sad tale of Mr. N 



Decent student 



Ministry of Higher Education 
& Scientific Research 

Foundation of Technical Education 



j V i 
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Ref. / 
Date/ 

To / Whom it may concern A W» 

This is to certify that Mr . N whose photograph is attached above is a graduate of 

the College of Health and Medical Technology / Baghdad and awarded the degree of Bachelor of 
Medical Technology in Anaesthesia / Anaesthesia Tech. Dept. on 1/9/2005 of the first attempt with 



standard (Very good) and below are the grades that 


obtained during the four years of study 






Second Year 2002/2003 


Third Year 2003/2004 




Subject 


Mark 


Hours per 

week 


Units 


Subject 


Mark 


Hours per 
week 


Units 


Til. 


Pra. 


Th. 


Pr;i. 


Anaesthesia ( I) 


92 


3 


A 


10 


Anaesthesia (2) 


89 


3 


6 


12 


Anaesthetic Equipment 
Technology^ 1 ) 


89 


j 


4 


6 


Intensive Care Technology (. 1 ) 


92 


i 


5 


6 


Physiology of Respiratory 
Svsteni 


99 


3 


3 


8 


Anaesthetic Equipments 
i echnology (2) 


76 


i 


5 


6 


Surgery { I ) 


82 


1 


3 


4 


Medicine (2) 


83 


2 


3 


6 


Medicine (I) 


94 


2 


3 


6 


Surgery (2) 


S3 


1 


3 


4 


Phurmacolouv ( ! ) 


83 


1 


2 


A 


Pharaniacology (2) 


86 


1 


T 


4 


Statistics 


82 


] 


2 


4 




Average 


n8&520 


Result: Pass Average 


90.429 


Result: Pass 







Fourth x 


ear 2004/2005 




Subject 


Mark 


Hours |jer 
week 


Units 


Th. 


Pra. 


Anaesthesia (3) 


89 


2 


4 


8 


Intensive Care Technology- 

(2) 


93 


n 


4 


S 


Anaesthetic Equipments 
Technoljigy(3) 


87 


i 


4 


8 


Medicine & Surgery 


69 


1 


1 


4 


Nursing 


86 


1 


4 


6 


Project 


79 




■*! 


4 


Result :Pas:, 




A vera 


ge -84.950 



1. General average for the period of study -(86.941) 

2. The graduate sequence is (I) from (22) , 

3. (*) refers to re-sit exams. 

4. No. of years failed and years deferred: Noil . 

5. Summer training: Pass. 

6.This period of study has been for 3 years, because the graduate has previously graduated from a Technical Institute. 
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Wanted to help US 
forces in Iraq... 



M/NISTR Y OF INTKRIOK 

General Directorate Of Travel 

And Nationality 

5Vb.; 

(Date: / / 2006 






• • 



Civil Register No : 

Page No : 

Mohafadha ( Governorate) 

Name And Surname . 

Father and Grand 

Father's Name : 

Mother and Her 

Father's Name : 

Sex : Male 

Religion :Muslim 

Occupation : 

Marital Status : Married 

Nationality :lraqi 

Date of Birth : 

Place of Birth : Baghdad 




This is to certify that above information 
fs identical with our Civil Register and 

Up to date. 
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Copy of 'Entry 1957 



and it worked out 

well! 




DEPARTMENT OF THE ARMY 

A Company, 4th Brigade Special Troops Battalion 
506th Regimental Combat Team, 101st Aiibome Division (Air. Assault) 
Forward Operating Base Loyalty. Iraq 
APO, AE 09390-1505 



^ 



REPLY TO 
AllhNIlONOF 



6 November 2006 



MEMORANDUM FOR RECORD 



SUBJECT: Letter of Reference fwN, 



1. N has distinguished himself through outstanding performance as a combat 
interpreter supporting A Company (Engineers). 4th Brigade Special Troops Battalion from January 
2006 through July 2006. 

2. For several years, N has supported Coalition Forces in the security and safety of Baghdad and 
the Iraqi people. He displays an unparalleled level of courage on a daily basis. Not only does he 
voluntarily travel with Coalition Forces into the most dangerous areas of Baghdad, he lives with, 
and overcomes, fear everyday in his own home. N is forced to live a secret life that he must hide 
from family and friends to protect them, as well as himself from torture and certain death at the 
bands of terrorists. His love of his people and his country shows no bounds as he chooses this life 
in (he hopes that his efforts can hefp bring peace to his homeland. 

3. X is a hard working native Iraqi who speaks English well. His calm, relaxed approach with 
local nationals while on patrol gives units he supports an edge during courtier insurgency operations. 
K has a deep concern, for the future of Iraq and its people. His ability to relate to and understand 
the people of Baghdad has most certainly added a dimension to the tight that any normal Coalition 
unit would not be able to provide itself. N is a credit to the Iraqi people. His performance 
during the seven months was excellent and his displays of selfless service and personal courage are 
examples for all to follow. N is a good man. a good friend, and would make an 
upstanding U.S. citizen. 



But at a high price... 



"...is forced to live a 
secret life that he must 

hide from family and 

friends to protect them, 

as well as himself, from 

torture and certain death 

at the hands of 

terrorists' 




DEPARTMENT OF THE ARMY 

A Company, 4lh Brigade Special Troops Battalion 
506th Regimental Combat Team. 101st Aiibcme Division (Ait Assault) 
Forward Operating Base Loyalty. Iraq 
APO, AE 09380-1505 



6 November 2006 

MEMORANDUM FOR RECORD 
SUBJECT: Letter of Reference tor N, 

.1, N has distinguished himself through outstanding performance as a combat 

interpreter supporting A Company (Engineers). 4th Brigade Special Troops Battalion from January 
2006 through July 2006. 

2. For several years, N has supporced Coalition Forces in the security and safety of Baghdad and 
the Iraqi people. He displays an unparalleled level of courage on a daily basis. Not only does he 
voluntarily travel with Coalition Forces into the most dangerous areas of Baghdad, he lives with, 
and overcomes, fear everyday in his own home. N is forced to live a secret life that he must hide 
from family and friends to protect them, as well as himself, from torture and certain death at the 
hands of terrorists. His love of his people and his country shows no bounds as he chooses this life 
in the hopes that his efforts can help bring peace to his homeland. 

3. N is a hard working native Iraqi who speaks English well. His calm, relaxed approach with 
local nationals while on patrol gives units he supports an edge during counter insurgency operations. 
N has a deep concern tor the future of Iraq and its people. His ability to relate to and understand 
the people of Baghdad has most certainly added a dimension to the tight that any normal Coalition 
unit would not be able to provide itself. N is a credit to the Iraqi people. His performance 
during the seven months was excellent and his displays of selfless service and personal courage are 
examples for all to follow. N is a good man, a good friend, and would make an 
upstanding U.S. citizen, 

4. Point of Contact of this memorandum is the undersigned al samnel.galvk jii.us. army.mii . 



,■ ^-tfi-^^f -.. ■■ '■■■ <-■ 

SAMUEL R-GALYK 
1LT, EN'"' 
Operations Officer 



Welcome to the US 

MrN! 





This slide intentionally left blank 



A bit about ethics... 



Do the folks features here 
know that they are sharing 
this information? 

In most cases, we don't think 
that they do... 

Where we have all of the 
appropriate information, we 
have/are in the process of 
contacting all of the "victims" 
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The Defense 



Configure your firewal l/proxy/l DS/I PS/content filter/ 
traffic shaper to block and alert on all P2P traffic 

> Utilize the same technology in a host based 
system as well! 

Perform regular software audit of workstations 
laptops for P2P clients 

> What happens when the asset leaves your 
facility? 

Prevent users from installing the P2P clients to start 
with... 

Audit P2P networks for your own sensitive 
information! 

If you absolutely must participate in P2P, be VERY 
mindful about what is being shared! 







The Defense 



Although there is at 
least one company 
that WILL provide 
professional services 

They also have 
services for 
individuals, but in 
ironic twist of fate... 
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The Defense 



The link for personal services is 404... 



fooo 


The page 


1 *) T C^O C : 0^0 Q&) (Jf ^ £§ Uj CJ_iX htt P ; //www.tiversa,com/solutions;personal/ 


-*^^ 






Proxy: | None t] ^ Apply ^ Edit ^Remove |_J Add Status:Using None ^Preferences. 




t Security Fix - Report: Locations... © The page cannot be found ©J 






The page cannot be found 

The page you are looking for might have been removed, nac its name charged, or is 
temporarily unavailable. 

Please try the following: 

* Make sure that the Web site address d splayed ir tie address bar of your 
browser is spelled snd "ormatted correctly, 

* If you reached ttiis page by clicking a link, contact the Web site administrator to 
clei: them that the link is incorrectly formatted. 

* Click the Esck button to f y another ink. 




HTTP Error 404 - File or directory not found 
Internet Information Services (IIS) 



Tiversa? 



Apparently Tiversa does a couple of things for you as a corporate 
customer 

• You provide them a list of document names, search terms and 
keywords 

• They scan the entirety of the P2P world and analyze the 
results 

• Look for leaks from your organization 
They have much more to offer too... 




The Cactus Project 



We wanted a tool (or tools) that would do a bunch 
of these searches without intervention 

Here's a list of the features weVe currently looking 
to include in our tool 

User Defined interval based repeated searches 

Repeatable, modifiable search terms 



Automatic downloading of positive search results 



Limit by IP range for specific customer 
engagements 

Additional support for other P2P protocols 

Monitor all mesh search terms? 

Here's the initial release of some methodologies 




http://www.pauldotcom.com/cactusproject.html 



The Cactus Project 



Understanding gnutella protoco 
== understand the project 

Finding best of breed tools 

Writing tools to fill in gaps 
where needed 



Maybe develop a whole 
framework? 




http://vv^vw.pauldotcom.com/cactusproject.html 



Best of breed so far 

mutella 




Auto re-search 
(RequeryPeriod) 

Auto download 

Auto compare for the 
downloads! 



Smarter filtering pre download 




I Current search results, matching your criteria 
QLERY:" passport.jpg - HIT3:20 
i) "007 passport. j pg. mov ' 7.12M known :New 
shal : NNSJ4GWNMDKSRD3TX5PBRSXDXTDRn_NGQ_ 
extra: GGEP Block: ID= 'ALT ' DATA=-odiscarded (unknown extension )> 
217.129.170.208:47349 speed :T1 LimeWire time:2< 



Auto Searches 



Configure your GWebCaches 
I Google for updated one 

> I like http://gcachescan.jonatkins.com/ 

> Populate from top 3 in list 

set SaveSearches true 
Configure your client 

> to retain searches 

set GWebCache [1-3] http : //site . gov 

> to search only by filename 

set StrictSearch true 

Create your search 

find [search term] /autoget 



Good help is so hard to 

find... 

• We know people are 
searching, but what are they 
looking for? 

• Enter CACTUS lurker 

• YesJtisaWiR 

• Apologies? You bet. 

• But in the mean time, we 
can use another tool to get 
an idea... 



In the meantime... 



GTK-Gnutella 

In preferences, set Ultra 
Mode 

• Beware of firewall! 
Search monitor 

• Once enabled will pull all 
search terms destined to 
subordinate leaves. 



Network Gnutella 



Bandwidth 



Downloads 



Uploads 



Gnutella network mode 



r 



Configured peermode ultra node 



Ultrapeer mode settings 
Legacy connections 

Maximum # of leaves 






* 


150 


* 



□ Monitor bad node IP addresses 

□ Monitor and auto-ban unstable servent types 



Network 
Clear 



Searches 



Downloads 



Uploads 



Statistics Search Monitor 



Search monitor enabled 



Future Development 



How do we look for folks finding 
our Secret Sauce? 

> Serve up fake files? Is there a 
better way? 



? 



Monitor folks leaking information? 

> Ultra nodes have some 
powerful capabilities for 
searches and routing. 

I am need of help! 
larry@pauldotcom.com 



Conclusions 



Apparently our security education isn't 
reaching the unwashed masses 

• How do we accomplish that as an 
industry? 

Clearly, sharing too much information 
via P2P networks is way too easy. 

• Whether it be at home or in a 
corporate environment. 

The goods are out there... 

I've certainly learned a lot! 



I WANT TO 
BELIEVE 



EOF 

http://www.pauldotcom.com 




larry@pauldotcom.com 
twitter.com/haxorthematrix 



